Several OS command injection vulnerabilities exist in the device firmware in the /var/salia/mqtt.php script. By publishing a specially crafted message to a certain MQTT topic arbitrary OS commands can be executed with root permissions.
References
| Link | Resource |
|---|---|
| https://r.sec-consult.com/echarge |
Configurations
No configuration.
History
21 May 2025, 17:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
21 May 2025, 12:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-05-21 12:16
Updated : 2025-05-21 20:24
NVD link : CVE-2025-27804
Mitre link : CVE-2025-27804
CVE.ORG link : CVE-2025-27804
JSON object : View
Products Affected
No product.
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')